lokibot

General

Target
399b01695c79b382f13cd4cac008547c_JaffaCakes118
Size 243KB
Sample240330-lv7xtsdd95
SHA256 a40d51f510b1b3687bade10d6c2e2afd922914f19bca239788281422fe03aeef
MD5 399b01695c79b382f13cd4cac008547c
SHA1 5b4f7d6e1af2af75e9cdeb011dfacede71ccf278
SHA512 d2c5f88e63a8d2554550fd3bd55b542dedd46b13a78cf64e9d41d8f02651b49fd741d110810fd48d2af711f70db9f743e12dc747f4f909e960557b081f3cdc10
SSDEEP 6144:wBlL/cTo0vbBCqshZoAvjL6iWQTODHhmzaf4u0VuWGjQ:CeTo0vbBioSjJTO0Wf4HMa
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

lokibot

C2

http://63.250.40.204/~wpdemo/file.php?search=719442
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Targets

- Target
  399b01695c79b382f13cd4cac008547c_JaffaCakes118
- Size 243KB
- SHA256 a40d51f510b1b3687bade10d6c2e2afd922914f19bca239788281422fe03aeef
- MD5 399b01695c79b382f13cd4cac008547c
- SHA1 5b4f7d6e1af2af75e9cdeb011dfacede71ccf278
- SHA512 d2c5f88e63a8d2554550fd3bd55b542dedd46b13a78cf64e9d41d8f02651b49fd741d110810fd48d2af711f70db9f743e12dc747f4f909e960557b081f3cdc10
- SSDEEP 6144:wBlL/cTo0vbBCqshZoAvjL6iWQTODHhmzaf4u0VuWGjQ:CeTo0vbBioSjJTO0Wf4HMa
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  $PLUGINSDIR/kwptzjmus.dll
- Size 32KB
- SHA256 cf60e722fab88e37816f36336859f64c77d794ead0bd169b3774e605575cc526
- MD5 a919bc6b8cda798dd5213b7dd1e8f9d9
- SHA1 061257e87ec84a9e15b229e8acdda0d743722cf3
- SHA512 5079b03eaf3274ab69bf165bc925297b2b506ace912d5cb059549b925aaecf66d908665e84300690fd4f9858ff3e0c7ea9c79d1a3a3fe61db2454e58b790e282
- SSDEEP 384:sbrSlBLFWcm6LMgLbhG3/EWMHDV/rsWqB9RAY+KjsGkGw8yX7:s0Rdm+L0JMH9rW9r+osJAI
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

lokibot collection spyware stealer trojan
- Lokibot
  Lokibot is a Password and CryptoCoin Wallet Stealer.
  trojan spyware stealer lokibot
- Blocklisted process makes network request
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook profiles
  collection
- Suspicious use of SetThreadContext
behavioral3 behavioral4